HIPAA Compliance

1. HIPAA Overview

The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for protecting patient health information. Organizations handling Protected Health Information (PHI) must comply with HIPAA Privacy Rule, Security Rule, and Breach Notification Rule.

2. Our HIPAA Posture

2.1 Codec Software (Local Processing)

2.2 Support Interactions (BAA Required)

2.3 Your Responsibility as Covered Entity

If you are a HIPAA Covered Entity (hospital, clinic, PACS vendor), you remain responsible for:

• Ensuring your systems using our codec comply with HIPAA Security Rule
• Implementing access controls, audit logs, and encryption
• Training your workforce on HIPAA compliance
• Executing BAAs with your own Business Associates
• Conducting risk assessments
• Breach notification if PHI is compromised

3. HIPAA Security Rule Considerations

3.1 Technical Safeguards

While the codec itself doesn't handle PHI transmission, consider these implementation best practices:

3.2 Physical Safeguards

• Device Security: Lock MacBooks/Mac Studios when unattended
• Facility Access: Restrict access to workstations running the codec
• Disposal: Securely wipe devices before disposal (NIST SP 800-88)

3.3 Administrative Safeguards

• Risk Assessment: Conduct annual HIPAA risk analysis
• Policies: Document codec usage in your security policies
• Training: Train staff on secure codec usage
• Incident Response: Have a breach response plan

4. Business Associate Agreement (BAA)

4.1 When BAA is Required

We will sign a BAA if:

• You need to share PHI-containing images for support
• You request custom development involving PHI
• You use future cloud-based services (if/when launched)
• Your compliance officer requires it for audit purposes

4.2 BAA Key Terms

Our standard BAA includes:

• Permitted Uses: Technical support and codec improvement only
• Safeguards: Encryption, access controls, audit logs
• Subcontractors: AWS (if cloud services used) - we ensure downstream BAAs
• Breach Notification: Notify you within 24 hours of discovery
• Termination: Return or destroy PHI upon contract end
• Right to Audit: You may audit our compliance (with reasonable notice)

4.3 Requesting a BAA

5. DICOM and Medical Imaging Considerations

5.1 Metadata Handling

DICOM images contain PHI in metadata tags (patient name, MRN, DOB, etc.). The codec:

• Preserves all DICOM tags during compression (required for compliance)
• Does NOT extract, log, or transmit metadata
• Supports DICOM anonymization (if you apply it before codec)
• Your responsibility: Anonymize images before sharing with us for support

5.2 De-Identification

If sending us sample images, use DICOM de-identification per HIPAA Safe Harbor method (45 CFR § 164.514(b)):

• Remove 18 identifiers: names, dates (except year), MRN, etc.
• Use tools like: CTP, DICOM Anonymizer, or Orthanc
• Verify pixel data doesn't contain burned-in PHI (text overlays)

6. Breach Notification

6.1 If You Experience a Breach

If PHI processed by our codec is compromised on your systems:

• Notify affected individuals within 60 days (HIPAA Breach Rule)
• Report to HHS Office for Civil Rights
• Notify media if > 500 individuals affected
• Inform us if the codec contributed to the breach

6.2 If We Experience a Breach

In the unlikely event we experience a breach involving your PHI (e.g., during BAA-covered support):

• We will notify you within 24 hours of discovery
• Provide details of the breach and mitigation steps
• Cooperate with your breach response and notification obligations

7. Enforcement and Penalties

HIPAA violations can result in significant penalties:

• Civil penalties: $100 - $50,000 per violation (up to $1.5M annually)
• Criminal penalties: Fines up to $250,000 and 10 years imprisonment
• State laws: Additional penalties under state breach notification laws

Ensure your implementation complies with all applicable regulations.

8. Compliance Resources

8.1 Documentation We Provide

• Software Description Document (for your risk assessment)
• Security architecture overview
• Validation testing results
• Business Associate Agreement (upon request)

8.2 External Resources

• HHS HIPAA Website
• HIPAA Security Rule Guidance
• NIST Cybersecurity Framework
• HITRUST Common Security Framework

9. Frequently Asked Questions

10. Contact Information